ConfigMap：k8s標準資源乡洼，將配置文件做成k8s資源，使其它資源可加載其中配置
Secret：實現(xiàn)加密功能的安全配置文件。由多個key:val中組成
創(chuàng)建configmap資源彤敛，可直接使用kubectl創(chuàng)建并且傳值
kubectl create configmap filebeat-cfg -n config --from-literal=redis_host="redis.default.svc.cluster.local" --from-literal=log_level="Info"
--from-literal=log_level="Info" 此字段表示為創(chuàng)建一個key為log_level并且為這個可以賦值為info
而后創(chuàng)建pod，并引用configmap資源中的key
apiVersion: v1
kind: Pod
metadata:
name: pod-cfg-demo
namespace : config
spec:
containers:
name: filebeat
image: ikubernetes/filebeat:5.6.5-alp ine
env:#引用環(huán)境變量值
- name: REDIS_ HOST #名稱了赌，REDIS_HOST為容器內(nèi)部的變量名稱
valueFrom:#引用其他資源傳遞變量墨榄，
configMapKeyRef :#表示引用configmap資源
name: filebeat-cfg #configmap名稱，為剛才創(chuàng)建的configmap資源
key: redis_host#key名稱
- name: LOG_LEUEL #同上也為容器內(nèi)的變量名稱
valueFrom:
configMapKeyRef :
name: filebeat-cfg
key: log_level
連接至容器內(nèi)部查看環(huán)境變量傳遞成功了揍拆，但是我們修改configmap中key 的值不會生效渠概，除非重建pod
基于存儲卷引用configmap
創(chuàng)建2個配置文件為存儲卷提供配置
定義好configmap
kubectl create configmap nginx-cfg --from-file=./server1.conf --from-file=server-2./server2.conf -n config
--from-file=./server1.conf #利用文件來傳遞參數(shù)，沒有給key名稱默認為文件名稱為key嫂拴，文件內(nèi)容為value
--from-file=server-2./server2.conf -n config#也可以手動添加key名播揪。并指定文件內(nèi)容為value，且目錄為相對路徑不能為絕對路徑
apiVersion: v1
kind: Pod
metadata:
name: myapp-pod
namespace: config
spec:
containers:
- name: myapp
image: ikubernetes/ myapp:v1
volumeMounts : #定義容器使用存儲卷掛載
- name: config#使用存儲卷的名稱
mountPath: /etc/nginx/conf.d/
volumes:#定義存儲卷
- name: config#存儲卷名稱
configMap:#存儲卷類型：這里為configmap而不是nfs其他的文件系統(tǒng)筒狠，可以指定configmap資源為存儲卷
name: nginx-cfg#configmap名稱猪狈，這里為我們剛才創(chuàng)建的cm名稱
items :#使用cm中的key
- key: server1.conf #key名稱
path: server-first.conf #表示映射為文件時文件名是什么
- key: server-2
path: server-second.conf
kubectl edit cm nginx-cfg -n config#在線修改時會自動同步至容器內(nèi)部
secret資源。經(jīng)過base64編碼后的配置中心辩恼，用于傳遞敏感信息的值
secret類型：
tls類型：專用ssl雇庙。tls格式的證書和私鑰打包進secret中谓形。不管原來文件叫什么，通通進行統(tǒng)一疆前，證書一定會映射為叫tls.crt寒跳。私鑰為tls.key
generic：非證書認證時使用的普通的敏感信息類型
docker-registry：用于連接dockerhub中時使用的賬戶認證信息類型
kubectl create secret generic mysql-root-password -n config --from-literal=password=centos #創(chuàng)建通用型secret資源
創(chuàng)建pod使用secret中的key傳遞給容器
apiVersion: v1
kind: Pod
metadata:
name: mysql
namespace: config
spec:
containers:
- name: mysql
image: mysql:5.6
env: #容器內(nèi)部定義的變量
- name: MYSQL_ROOT_PASSWORD#此名稱為容器內(nèi)部定義的變量名，不是隨便給的竹椒。需要傳遞參數(shù)才能啟動mysql容器
valueFrom: #定義值
secretKeyRef: #值類型為secret
key: password #key名稱
name: mysql-root-password #secret的名稱
交互式連接mysql可直接使用傳遞的參數(shù)登陸mysql
kubectl create secret tls mysql-cert --cert=./myapp.crt --key=./myapp.key -n config#創(chuàng)證書類型secret配置童太，是其他pod能將此secret當作證書認證
apiVersion: v1
kind: Pod
metadata:
name: myapp-pod-tls
namespace: config
spec:
containers:
- name: myapp
image: ikubernetes/myapp:v1
volumeMounts:
- name: config
mountPath: /etc/nginx/conf.d/
- name: tls
mountPath: /etc/nginx/certs/#容器內(nèi)部的掛載路徑
volumes:#定義存儲卷類型
- name: config 存儲卷名稱
configMap: #存儲卷類型configmap
name: nginx-cfg
items:
- key: server1.conf
path: server-first.conf
- key: server-2
path: server-second.conf
- name: tls
secret: #此存儲卷類型為secret
secretName: mysql-cert #secret的名稱，剛才我創(chuàng)建為mysql-cert
items: #定義key
- key: tls.crt #注意原key和crt為什么名稱胸完。在secret中定義都為tls.key,tls,crt
path: myapp.crt #在容器中名稱相對路徑為mountPath: /etc/nginx/conf.d/
- key: tls.key
path: myapp.key
mode: 0600 #定義權(quán)限
StatefulSet：管理有狀態(tài)應(yīng)用书释，但對于擴縮容需要自己寫代碼操作，statefulset只負責提供給pod一個單一的標識赊窥，存儲設(shè)備爆惧。
operator：使用不同應(yīng)用程序，對不同的應(yīng)用程序有程序的所有運維管理操作锨能，不同的應(yīng)用程序有不同的operator扯再，operator運行為k8s集群中的pod，用于控制有狀態(tài)的集群應(yīng)用
定義statefulset：
先創(chuàng)建好幾個pv腹侣，使用靜態(tài)創(chuàng)建
apiVersion: v1
kind: PersistentVolume
metadata:
name: pv-nfs-v0
labels:
storage: nfs
spec:
accessModes: ["ReadWriteOnce ","ReadwriteMany","ReadOnlyMany"]
capacity:
storage: 1Gi
volumeMode: Filesystem
persistentvolumeReclaimPolicy: Retain
nfs:
server: 192 .168.1.199
path: /vols/v0
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: pv-nfs-v1
labels:
storage: nfs
spec:
accessModes: ["ReadWriteOnce ","ReadwriteMany","ReadOnlyMany"]
capacity:
storage: 5Gi
volumeMode: Filesystem
persistentvolumeReclaimPolicy: Retain
nfs:
server: 192 .168.1.199
path: /vols/v1
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: pv-nfs-v2
labels:
storage: nfs
spec:
accessModes: ["ReadWriteOnce ","ReadwriteMany","ReadOnlyMany"]
capacity:
storage: 5Gi
volumeMode: Filesystem
persistentvolumeReclaimPolicy: Retain
nfs:
server: 192 .168.1.199
path: /vols/v2
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: pv-nfs-v3
labels:
storage: nfs
spec:
accessModes: ["ReadWriteOnce ","ReadwriteMany","ReadOnlyMany"]
capacity:
storage: 5Gi
volumeMode: Filesystem
persistentvolumeReclaimPolicy: Retain
nfs:
server: 192 .168.1.199
path: /vols/v3
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: pv-nfs-v4
labels:
storage: nfs
spec:
accessModes: ["ReadWriteOnce ","ReadwriteMany","ReadOnlyMany"]
capacity:
storage: 5Gi
volumeMode: Filesystem
persistentvolumeReclaimPolicy: Retain
nfs:
server: 192 .168.1.199
path: /vols/v4
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: pv-nfs-v5
labels:
storage: nfs
spec:
accessModes: ["ReadWriteOnce ","ReadwriteMany","ReadOnlyMany"]
capacity:
storage: 5Gi
volumeMode: Filesystem
persistentvolumeReclaimPolicy: Retain
nfs:
server: 192 .168.1.199
path: /vols/v5
#而后創(chuàng)建statefulset資源叔收，綁定使用pv
定義好statefulset
apiVersion: v1
kind: Service #定義好前端service
metadata:
name: myapp-sts-svc
namespace: sts
labels:
app: myapp
spec:
ports:
- port: 80
name: web
clusterIP: None
selector:
app: myapp-pod
containers: sts
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: statefulset-demo
namespace: sts
spec:
selector:
matchLabels:
app: myapp-pod
containers: sts
serviceName: "myapp-sts-svc"
replicas: 2 #pod副本數(shù)量
template:#pod模板
metadata:
labels:
app: myapp-pod
containers: sts
spec:
terminationGracePeriodSeconds: 10#刪除pod時長
containers:
- name: myapp
image: ikubernetes/myapp:v1
ports:
- containerPort: 80
name: web
volumeMounts:
- name: myapp-pvc
mountPath: /usr/share/nginx/html
volumeClaimTemplates:#定義好pvc資源模板
- metadata:
name: myapp-pvc #pvc名稱
namespace: sts #所屬名稱空間
spec:
accessModes: [ "ReadWriteOnce" ] #訪問模型為單路讀寫
resources: #請求占用多少資源
requests:
storage: 2Gi
